Re: OSPF BFD Flapping Every Minute on 3 Routers

Verbatim · ‎11-13-2023

Hello,

There are three routers that all seem to be experiencing OSPF flaps with each other. On each router, the flaps are taking place each minute, as BFD is configured for OSPF.

Map:

(Map note: in all cases where the IP has been removed, the first three octets of all of them were the same; the last octet was preserved).

OMITTED1 is IP on Router 2, subinterface gig 0/0/0.801

OMITTED2 is IP on Router 3, subinterface gig 0/0/0.801

OMITTED3 is IP on Router 1, subinterface gig0/0/0.801

UPDATE: Router 1 ospf debug adjacency logs attached.

Router 1 logs: r1.txt attached. Router 2 logs: r2.txt attached. Router 3 logs: r3.txt attached.

Note: Below has some lines omitted.

Router1>show ip ospf neighbor

Neighbor ID Pri State Dead Time Address Interface

10.255.253.227 1 FULL/DROTHER 00:00:35 10.255.253.242 GigabitEthernet0/0/0.602

10.255.253.234 1 FULL/DROTHER 00:00:38 10.255.253.241 GigabitEthernet0/0/0.602

10.255.253.244 1 FULL/BDR 00:00:31 10.255.253.244 GigabitEthernet0/0/0.602

10.255.253.245 1 FULL/DROTHER 00:00:31 10.255.253.245 GigabitEthernet0/0/0.602

OMITTED2 1 FULL/DROTHER 00:00:39 OMITTED2 GigabitEthernet0/0/0.801

OMITTED1 1 FULL/DROTHER 00:00:24 OMITTED1 GigabitEthernet0/0/0.801

Router2>show ip ospf neighbor

Neighbor ID Pri State Dead Time Address Interface
10.255.253.227 1 2WAY/DROTHER 00:00:34 10.255.253.242 GigabitEthernet0/0/0.602
10.255.253.234 1 2WAY/DROTHER 00:00:30 10.255.253.241 GigabitEthernet0/0/0.602
10.255.253.244 1 FULL/BDR 00:00:37 10.255.253.244 GigabitEthernet0/0/0.602
10.255.253.246 1 FULL/DR 00:00:34 10.255.253.246 GigabitEthernet0/0/0.602
OMITTED2 1 2WAY/DROTHER 00:00:32 OMITTED2 GigabitEthernet0/0/0.801
OMITTED3 1 FULL/DR 00:00:35 OMITTED3 GigabitEthernet0/0/0.801

Router3>show ip ospf neighbor

Neighbor ID Pri State Dead Time Address Interface
OMITTED 0 FULL/ - 00:00:36 OMITTED Tunnel10
OMITTED 0 FULL/ - 00:00:36 OMITTED Port-channel3.111
OMITTED 0 FULL/ - 00:00:32 OMITTED Port-channel3.1306
10.255.253.246 0 EXCHANGE/ - 00:00:39 10.255.253.246 GigabitEthernet0/0/0.602
10.255.253.231 0 FULL/ - 00:00:37 10.255.253.226 Port-channel3.1604
OMITTED 1 FULL/DR 00:00:31 OMITTED GigabitEthernet0/0/0.3820
OMITTED 0 FULL/ - 00:00:34 OMITTED Port-channel3.3822
OMITTED 1 FULL/DR 00:00:30 OMITTED GigabitEthernet0/0/0.3810
OMITTED 1 FULL/BDR 00:00:31 OMITTED GigabitEthernet0/0/0.3810
OMITTED 0 FULL/ - 00:00:33 OMITTED Port-channel3.3812
10.9.7.253 1 FULL/DROTHER 00:00:36 10.9.7.194 GigabitEthernet0/0/0.3800
10.9.7.255 1 FULL/DR 00:00:36 10.9.7.193 GigabitEthernet0/0/0.3800
10.9.7.242 0 FULL/ - 00:00:31 10.9.7.242 Port-channel3.3802
OMITTED1 0 FULL/ - 00:00:35 OMITTED1 GigabitEthernet0/0/0.801

MHM Cisco World · ‎11-13-2023

change the network to P2P not broadcast and check again
can I see config of BFD

Verbatim · ‎11-13-2023

I've set:

ip ospf network point-to-point

on the 6 subinterfaces (2 on each router); that's what started causing the adjacency resets in the logs.

Verbatim · ‎11-13-2023

Logs are filling up with: Adjacency forced to reset

Router1#show run | section bfd
ip ospf bfd
bfd interval 999 min_rx 999 multiplier 3
ospfv3 1 ipv6 bfd
bfd interval 999 min_rx 999 multiplier 3
ip ospf bfd
bfd interval 999 min_rx 999 multiplier 3
ip ospf bfd
bfd interval 999 min_rx 999 multiplier 3
ip ospf bfd
bfd interval 999 min_rx 999 multiplier 3
ip ospf bfd
bfd interval 999 min_rx 999 multiplier 3
snmp-server enable traps bfd

Verbatim · ‎11-13-2023

Router 2 logs attached

Verbatim · ‎11-13-2023

Router 1 interfaces (some excluded) attached

MHM Cisco World · ‎11-13-2023

Show ip ospf neighbor

The neighbor id have same subnet as interface !!

Can you double check IP of interface

Are some interface using dhcp?

Verbatim · ‎11-13-2023

No dhcp on these routers (did a word search on the configs for "dhcp"; only hit was remark in an ACL)

Router1>show interface gig0/0/0.801
Description: OMITTED, opw vrf
Internet address is OMITTED3/28

Router1>show interface gig0/0/0.602
Internet address is 10.255.253.246/28

Router3>show interface gig0/0/0.602
Internet address is 10.255.253.242/28

Router3>show interface gig0/0/0.801
Internet address is OMITTED2/28

Router2>show interface gig0/0/0.602
Internet address is 10.255.253.245/28

Router2>show interface gig0/0/0.801

Description: OMITTED, opw vrf
Internet address is OMITTED1/28

Verbatim · ‎11-13-2023

Attached R1 ospf debug adjacency logs. Excerpt:

094678: Nov 13 18:42:00.539 utc: OSPF-801 ADJ   Gi0/0/0.801: 2 Way Communication to OMITTED2, state 2WAY
094679: Nov 13 18:42:00.539 utc: OSPF-801 ADJ   Gi0/0/0.801: Nbr OMITTED2: Prepare dbase exchange
094680: Nov 13 18:42:00.539 utc: OSPF-801 ADJ   Gi0/0/0.801: Send DBD to OMITTED2 seq 0xFE8 opt 0x52 flag 0x7 len 32
094681: Nov 13 18:42:00.540 utc: OSPF-801 ADJ   Gi0/0/0.801: OMITTED2 address OMITTED2 is dead, state DOWN
094682: Nov 13 18:42:00.540 utc: %OSPF-5-ADJCHG: Process 801, Nbr OMITTED2 on GigabitEthernet0/0/0.801 from EXSTART to DOWN, Neighbor Down: Adjacency forced to reset
094683: Nov 13 18:42:00.540 utc: OSPF-801 ADJ   Gi0/0/0.801: Nbr OMITTED2: Clean-up dbase exchange
094684: Nov 13 18:42:00.540 utc: OSPF-801 ADJ   Gi0/0/0.801: 2 Way Communication to OMITTED, state 2WAY
094685: Nov 13 18:42:00.540 utc: OSPF-801 ADJ   Gi0/0/0.801: Nbr OMITTED: Prepare dbase exchange
094686: Nov 13 18:42:00.540 utc: OSPF-801 ADJ   Gi0/0/0.801: Send DBD to OMITTED seq 0x360 opt 0x52 flag 0x7 len 32
094687: Nov 13 18:42:00.541 utc: OSPF-801 ADJ   Gi0/0/0.801: OMITTED address OMITTED is dead, state DOWN
094688: Nov 13 18:42:00.541 utc: %OSPF-5-ADJCHG: Process 801, Nbr OMITTED on GigabitEthernet0/0/0.801 from EXSTART to DOWN, Neighbor Down: Adjacency forced to reset
094689: Nov 13 18:42:00.541 utc: OSPF-801 ADJ   Gi0/0/0.801: Nbr OMITTED: Clean-up dbase exchange
094690: Nov 13 18:42:00.541 utc: OSPF-801 ADJ   Gi0/0/0.801: 2 Way Communication to OMITTED1, state 2WAY
094691: Nov 13 18:42:00.541 utc: OSPF-801 ADJ   Gi0/0/0.801: Nbr OMITTED1: Prepare dbase exchange
094692: Nov 13 18:42:00.541 utc: OSPF-801 ADJ   Gi0/0/0.801: Send DBD to OMITTED1 seq 0x16 opt 0x52 flag 0x7 len 32
094693: Nov 13 18:42:00.542 utc: OSPF-801 ADJ   Gi0/0/0.801: Rcv pkt  src OMITTED2 dst OMITTED3 id OMITTED2 type 2 if_state 4 : ignored due to unknown neighbor
094694: Nov 13 18:42:00.542 utc: OSPF-801 ADJ   Gi0/0/0.801: Rcv pkt  src OMITTED2 dst OMITTED3 id OMITTED2 type 2 if_state 4 : ignored due to unknown neighbor
094695: Nov 13 18:42:00.542 utc: OSPF-801 ADJ   Gi0/0/0.801: Rcv pkt  src OMITTED dst OMITTED3 id OMITTED type 2 if_state 4 : ignored due to unknown neighbor
094696: Nov 13 18:42:00.542 utc: OSPF-801 ADJ   Gi0/0/0.801: Rcv pkt  src OMITTED dst OMITTED3 id OMITTED type 2 if_state 4 : ignored due to unknown neighbor
094697: Nov 13 18:42:00.544 utc: OSPF-801 ADJ   Gi0/0/0.801: Rcv DBD from OMITTED1 seq 0x1EC4 opt 0x52 flag 0x7 len 32  mtu 1500 state EXSTART

Verbatim · ‎11-13-2023

Appears similar to https://community.infosecinstitute.com/discussion/110516/dmpvn-ospf-neighborship-flip-flop

MHM Cisco World · ‎11-13-2023

This dmvpn' you use tunnel but not dmvpn.

I see many neighbor share same subnet but I dont see any SW connect routers?